Malware on F5 BIG-IP APM appliances splices its PHP web shell into Apache's memory

Sophos has the malware patching the Apache binary, then hooking the PHP module loader, so that when Apache loads a legitimate BIG-IP PHP script the attacker's code is spliced into the copy held in memory ^[3][2]. Nothing malicious is written to the web root. Blackpoint Cyber threat intelligence engineer Sam Decker said someone checking the disk would find everything looking stock, because the code was never written there ^[2]. From there it behaves like any web shell: commands arrive as web requests to the appliance, which is how Hadrian CEO Rogier Fischer described the practical effect ^[6].

The evasion framing deserves a caveat, and it comes from one of the people quoted praising the tradecraft. Decker said network appliances typically have no disk-watching antivirus or endpoint monitoring, so there was no scan to evade in the first place ^[5]. Black Hills Information Security owner John Strand said there are few EDR products you can drop onto a network appliance and get comparable visibility ^[9]. Custom ELF loading and runtime code patching therefore buy stealth against a responder reviewing the filesystem after the fact, rather than against a real-time scanner that was never installed. Strand also said memory-resident malware is not new, tracing it back to Shadow Walker at Black Hat, and that the notable part is where this one runs ^[10].

That reframes the remediation question rather than the detection question. Fischer's position is that patching alone is not enough if the appliance may already be compromised, and that where a team cannot establish confidence an exposed appliance is clean, rebuilding from a trusted state may be safer than relying on conventional malware scans ^[6][8]. Strand names the case where rebuilding is also insufficient: an attacker with enough privileges moving deeper into the device, including firmware, at which point eradication gets very hard ^[13].

What the account does not carry is the detail a defender needs to scope this. There is no CVE, no named actor, no victim count, and no dates for the intrusions themselves beyond the Sept. 7 publication of the Sophos post ^[1][11]. The four practitioners quoted work at four companies, and none of them is Sophos, so every technical assertion here traces to a single primary account ^[12].

Sophos put the work in a familiar category: on-demand server-side code execution of the kind associated with web shells, implemented with deeper Linux and Apache-specific tradecraft, matching what its researchers have seen in other attacks on network infrastructure ^[4]. That is where the weight sits. The appliance is chosen for the absence of the agent, and in-memory implementation only has to hold long enough to survive a disk review by a responder who has no memory telemetry to fall back on ^[5][9].